kubernetes/kops · error

no keypair with id %s for %s

Error message

no keypair with id %s for %s

What it means

The keyset exists but does not contain an item with the requested keypairID, so no certificate/private key pair can be pinned. This means the recorded keypair ID points at a keyset entry that no longer exists.

Source

Thrown at upup/pkg/fi/nodeup/nodetasks/issue_cert.go:235

	if signer == "" {
		return nil, nil
	}

	if keypairID == "" {
		return nil, fmt.Errorf("missing keypairID for signer %s", signer)
	}

	keyset, err := keystore.FindKeyset(ctx, signer)
	if err != nil {
		return nil, fmt.Errorf("reading keyset for %s: %v", signer, err)
	}
	if keyset == nil {
		return nil, fmt.Errorf("keyset %q not found", signer)
	}

	item := keyset.Items[keypairID]
	if item == nil {
		return nil, fmt.Errorf("no keypair with id %s for %s", keypairID, signer)
	}

	return &staticKeystore{
		keyset:      signer,
		certificate: item.Certificate,
		key:         item.PrivateKey,
	}, nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Re-run kops update/apply so the task re-resolves to the keyset's current primary keypair
2. Stop pruning that keyset's items or widen the retention window (kops editor: keyset retention)
3. Update the IssueCert task's KeypairID to an existing item id
4. Verify keypairID belongs to this cluster's keyset, not another cluster's

Example fix

// before
KeypairID: fi.String("6727146218130581431") // pruned
// after
KeypairID: fi.String(keyset.Primary.ID) // current primary id

item, ok := keyset.Items[keypairID]
if !ok {
  return fmt.Errorf("keypairID %s gone; use primary %s", keypairID, keyset.Primary.ID)
}

ks, err := newStaticKeystore(ctx, signer, keypairID, keystore)
if err != nil && strings.HasPrefix(err.Error(), "no keypair with id") {
  // re-resolve KeypairID from keyset.Primary.ID and retry once
}

When it happens

Trigger: newStaticKeystore reads keyset.Items[keypairID] and gets nil — the persisted KeypairID (e.g. an old primary) was removed when keysets were rotated/pruned.

Common situations: Keypair rotation followed by pruning deleted the referenced id; cluster restored from a partial backup; keypairID copied from a different cluster.

Related errors

• key %q not found
• key %q did not have primary id set
• missing keypairID for signer %s
• error generating private key: %v
• no keypairID for %q

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/a25dbdb7c69e339e. Report an issue: GitHub.